Catching up part 3: Out of bounds Jack

As a teenager, I didn’t know much about programing. But, when playing video-games, I often tried to imagine the plumbing behind the scenes, interacting with all the elements I was seeing on the screen. At that time cheating devices were not very common or affordable either, leaving my curiosity unsatisfied…

Fortunately, after several years of studies, I was finally on the right track to start exploring those ideas (and by the way, if I may, never give up!), which lead us today to a very enjoyable release!

When Head Hunter came out, I was really happy to see a MGS-like game on the Dreamcast: 3rd person view, mix of infiltration and action, training phases, etc. So many things were indeed common to both titles. Some months back, I was getting lost in the game files, as I sometimes do. I did basic string searches in the main binary to see whether there was any development leftovers. And it was a match!

Opening the 1ST_READ.BIN in Hex Workshop reveals interesting strings

It seems that the game at least at some point in its development had a debug menu. No surprises as developers always need this kind of tooling to manually test features. But anyway, it was a start! I then decided that disassembling the binary was worth a try. Quickly the code shown that all the debug strings where used in routines. Indeed, the strings could have been left and the code removed, which is what I noticed in most games.

“DEBUG MENU” being referenced by a routine

The hardest part was yet to come: re-connecting the debug menu to the rest of the code. To do that, to my mind it is important to have some knowledge of the game, at least here on how its main logic has been coded. If there was a debug menu, it is not an alternative to the game itself but rather something that runs next to it. All games have the same high level architecture where a loop orchestrates the main operations: gather user inputs, update game logic, update the physics and render the graphics (more or less in that order). It is then likely that the debug code was called from a subroutine, maybe in one related to the game logic.

Shitty screenshot of Head Hunter “usrMainLoop” (read the main game loop)

What are we looking for exactly? Basically a placeholder to call the debug menu code from the main logic block. Depending on how the developers implemented their release versus debug builds that placeholder may be replaced by an empty routine or, in the worse case, simply gone. I spare you the hours spent on injecting code and testing… But the approach ended up being successful!

Now you can enjoy Head Hunter with an almost complete debug menu! If I recall correctly the menu is even localized but I advise you to set your system to English otherwise some items are not sorted correctly. The menu can be opened at any time by pressing START and X. During the gameplay, pressing START however opens the game menu so it’s better to let that menu open then press and keep pressed the X button and finally START again the close the game menu: the menu closes and you get back to the game and the debug menu shows up. Congrats!

First look of the debug menu

I honestly really enjoyed cheating around with the debug features like the disabling of collisions. In some stages we are even close to what the game would have looked like in an opened world!

Time for you to try it out!

As always, the patches, patched binary and GDI images are available for download. But this time, I’ve added a little something: a GDI image that contains both discs. A must have for you cheaters :p

It is the most amazing Dreamcast version of Head Hunder I have ever played!

me

Download links

Patch: jc-headh-debug-patch-v1.0.zip

Patched GDI Images:

Bonus Pack: Headhunter v1.006 (2001)(Sega)(PAL)(M4)[!][h 1 disc + debug-mode japanese_cake]

12 replies on “Catching up part 3: Out of bounds Jack”

WOW! Not only have you given us a great cheat menu in the game, but you merged the game into a single image! Damn dude you pulled out all the stops for people with modern ODE solutions! Thanks a lot man! I am going to post about this over at Obscure!

Bonus Pack: Headhunter v1.006 (2001)(Sega)(PAL)(M4)[!][h 1 disc + debug-mode japanese_cake], not working for me, go to bios menu.

i had the original head hunter pal gd1 truncated without problem before.

I’ve downloaded and extracted the image and tested it with gdemu on a dreamcast with a retail bios: it works. Could you please give me some details on your setup? Thank you

I have a GDEmu 1.15 2018 clon, Dreamcast Pal with VGA cable, SD 32gb. Tools used to test GDEMU_SD and also GDMENUCardManager.

you have custom options? i will try in future.

Thanks for reply.

Fixed! i added to GDEMU.ini:
image_tests = 0

this option will allow to disable gdemu check, now works.

Wow nice work. I had totally forgot about this menu AT ALL. even though I often went through it to validate that graphics indeed looked at I should kn the real device vs the preview of the scenes that was used on PC

Hi Stephan! It seems you are probably the first person from the gaming industry to end-up on my blog 🙂 Welcome!
Thank you for your explanations. Do you remember what the « highpoly » scene was for? There a few other missing dev/gfx assets… would be nice to play with them!

Leave a Reply

Your email address will not be published. Required fields are marked *